Security policies
Public-facing summaries of the policies that govern how Lumiaxiom protects customer data. Full policy text is available under NDA on request to security@lumiaxiom.com. Last reviewed July 2026.
Access control
Least-privilege by default. Every table is protected by Postgres row-level security scoped to the org and role. Admin actions require re-authentication. Access is reviewed quarterly and logged to the tamper-evident evidence ledger.
Authentication & SSO
OAuth-based SSO with per-org role scoping (owner, admin, member, auditor). Sessions rotate on privilege changes. Auditor grants are scoped, time-bound, and revocable. Passwordless invites are single-use and expire.
Encryption
TLS 1.3 in transit. AES-256 at rest. Third-party tokens (e.g. GitHub access tokens) are encrypted with pgcrypto using a key stored in the managed secrets vault; plaintext is never persisted or logged.
Secure SDLC
All changes flow through pull requests. Every PR runs the same Lumiaxiom code-scan pipeline we sell to customers (secret detection, license conflicts, framework guardrails). Merges require review; production deploys require a signed commit chain.
Zero-retention source code scanning
Customer source code is parsed inside the scan runtime and immediately discarded. Only cryptographic hashes, findings metadata, and remediation decisions are written to the evidence ledger. We never train on customer code.
Incident response
24×7 pager rotation. Sev-1 incidents are acknowledged within 30 minutes. Post-mortems are published to the tenant's incident_reports timeline within 5 business days. Customers with an active DPA are notified of a confirmed personal-data breach within 72 hours.
Vulnerability disclosure
Coordinated disclosure. Report to security@lumiaxiom.com. We acknowledge within 24 hours, patch critical issues within 7 days, and credit reporters (with consent) in our changelog.
Backups & disaster recovery
Point-in-time database backups retained for 30 days. Cross-region replication for object storage. Documented RTO of 4 hours and RPO of 15 minutes for Tier-1 data.
Sub-processors
The current sub-processor list is published on the Trust Center. Material changes are announced 30 days in advance to customers on the Corporate tier.
Personnel & HR security
All personnel with production access complete background checks (where legally permitted), annual security awareness training, and sign a confidentiality agreement. Access is provisioned per role and revoked within one business day of role change or departure.